SCOPE

UAMS workforce

DEFINITIONS

Disclosure means the release, transfer, provision of access to, or
divulging of information in any manner (verbally or in writing) by UAMS to
persons who are not UAMS employees or students, or to any other person or entity
OUTSIDE of UAMS.

Fundraising means any activity
relating to the efforts of raising funds for the institution of UAMS and its
related health care facilities.

Minimum Necessary means limiting
Protected Health Information to the minimum necessary to accomplish the intended
purpose of the use, disclosure or request.

Protected
Health Information (PHI) means information that is part of an individual’s
health information that identifies the individual or there is a reasonable basis
to believe the information could be used to identify the individual, including
demographic information, and that (i) relates to the past, present or future
physical or mental health or condition of the individual; (ii) relates to the
provision of health care services to the individual; or (iii) relates to the
past, present, or future payment for the provision of health care services to an
individual. This includes PHI which is recorded or transmitted in any
form or medium (verbally, or in writing, or electronically). PHI excludes
health information maintained in educational records covered by the federal
Family Educational Rights Privacy Act and health information about UAMS
employees maintained by UAMS in its role as an employer.

UAMS
Workforce means for purposes of this Policy, physicians, employees,
volunteers, trainees, and other persons whose conduct, in the performance of
work for UAMS, are under the direct control of UAMS, whether or not they are
paid by UAMS.

POLICY

When a member of the UAMS workforce requests
access to any PHI stored electronically concerning a group of patients in order
to create a separate database or “data extract” for a use or disclosure
permitted by the HIPAA regulations, UAMS will undertake reasonable efforts to
limit access to the PHI in the data extract to the Minimum Necessary to carry
out the duties of the workforce member or to the amount reasonably necessary to
achieve the purpose of the disclosure.

All such uses or disclosures of data extracts
containing PHI must be in compliance with UAMS policies, federal and state law,
and HIPAA regulations.

UAMS will identify those persons and job titles
authorized to perform searches of data to produce and receive data extracts.
Periodic audits to determine compliance with this Policy will be conducted.

PROCEDURE

B.UAMS workforce members seeking an electronically stored data extract
containing PHI must complete a "Request for Data Extract" and submit it to the
UAMS custodian of the data who must be authorized by UAMS to perform searches of
data to produce extracts. A form is available for your convenience.

C.The following information must be included in the request:

1.
Name, job title and phone number.

2.
Complete description of data required including time periods, specific search
criteria and other information needed from the database.

3.
Entities or individuals for whom the use or disclosure of the PHI is required.

4.
The purpose of the use or disclosure of the data requested.

5.
“Yes” and “no” boxes for the requestor to indicate:

a.
Is the requestor a Principle Investigator or Research Assistant?

b.
If the data will be used for research, has an appropriate patient authorization
been obtained or has an IRB waiver of authorization been granted?

c.
If the data requested is to conduct research on deceased individuals, is the Certification for Use or Disclosure of Protected
Health Information for Deceased Individuals form current and on
file in the UAMS Office of Research and Sponsored Programs.

d.
If the data is to be used for Review Preparatory to Research, is the Certification for Use or Disclosure of Protected Health
Information for the Purpose of Review Preparatory to Research
form current and on file in the UAMS Office of Research and Sponsored Programs.

6.
Statement that the requesting party certifies that the information requested is
the Minimum Necessary to carry out his or her job duties; or if the request is
for a disclosure of PHI, a statement that the requesting party certifies that
the information requested is the Minimum Necessary to accomplish the purpose of
the disclosure.

7.
Any other information requested by the custodian of the database. A custodian
may request completion of a “Request for Data Extract” form.

D.If the purpose of the data request is for research or review preparatory to
research and the appropriate boxes under (C)(5)(b) through (C)(5)(d) above are
not marked “yes,” the request must be denied. If the purpose of the data
request is a use or disclosure that is not permitted by the UAMS policies,
federal or state law, and the HIPAA regulations, the request must be denied.

No other PHI may be used or disclosed by UAMS for
Fundraising purposes without the patient’s signed authorization using the UAMS
Authorization for Use/Disclosure of PHI for Fundraising Form.

F.The UAMS personnel providing the data extract shall record the date
the extract was given to the requesting party and shall maintain a copy of the
Request for a minimum of six years from the date of the request.

G.UAMS may rely, if such reliance is reasonable under the circumstances, on a
requested use as the Minimum Necessary for the stated purpose when the
information is requested by a professional who is a member of the UAMS workforce
if the professional represents that the information requested is the Minimum
Necessary to carry out his or her job duties; or if the request is for a
disclosure of PHI, UAMS may rely on representations from the person requesting
the information that the information requested is the Minimum Necessary to
accomplish the purpose of the disclosure.

H.For all requests of data extracts containing PHI that will be disclosed
outside of UAMS, the UAMS HIPAA Office must approve these requests, including
requests by individuals who are not members of the UAMS workforce.

·If data will be used for research,
has an appropriate patient authorization been obtained or has an IRB waiver of
authorization been granted? □ yes □ no □
N/A

If “no”, you must submit the appropriate
authorization or waiver before requested data can be released.

·If the data requested is to conduct research on deceased
individuals, is the Certification for Use or Disclosure of Protected Health
Information of Deceased Individuals form current and on file in the UAMS
Office of Research and Sponsored Programs, #636 □ Yes □ No □ N/A

·If data
requested is to be used for Review Preparatory to Research, is the
Certification for Use or Disclosure of Protected Health Information for the
Purpose of Review Preparatory to Research form current and on file in the
UAMS Office of Research and Sponsored Programs, #636 □ Yes □ No □
N/A